Can we get DEBUG loggin from the OpenSSL library?
维护者通常 1 天内回复
评估
- 难度
- 5/5
- 预计耗时
- 一周以上
- 新手友好度
- 28/100
- Issue 类型
- 功能
- 描述清晰度
- 基本清楚
- 活跃度
- 停滞
- 领域
- cryptography, security
调研方向
从 crypto/x509/t_x509.c 中引用的 OpenSSL 调试输出开始，并将其与 Ruby 的 OpenSSL::debug 行为进行比较。查看 verify_callback 和 store_context 示例，然后确定是否可以通过向 Ruby 暴露一个 flag，在不使用应用程序级回调的情况下提供等效的证书详细信息。定义并测试所提议的接口及其预期日志记录行为后，即视为完成。
由索引模型根据 Issue 内容生成。
描述
Hi,
Problem
As a developer I would like to see (DEBUG) logging from OpenSSL. We have a Ruby application that connects to Amazon Cloudfront to retrieve a file. This runs through a network outside of our control containing NAT gateways, proxies, etc.
This works 99% of the time, but Intermittently we get a self signed certificate error:
OpenSSL::SSL::SSLError (SSL_connect returned=1 errno=0
peeraddr=18.66.171.65:443 state=error: certificate verify failed
(self signed certificate in certificate chain))
But it doesn't show WHICH certificate (or subject, fignerprint, ...) is being seen.
Question / Request
Ideally we would have a ruby OpenSSL flag that instructs OpenSSL to do its (DEBUG) logging so we can get this information. I can see OpenSSL is logging the desired information in:
Is it possible to get the Ruby app to log this information?
I have found OpenSSL::debug=true, but this only seems to trigger debug logging done in this Ruby Gem.
In java we have -Djava.net.debug=ssl, but I realize that is not using OpenSSL underneath.
Alternative
I have found a way to get Ruby to log the self-signed certificate that is being seen in Ruby via https://github.com/mislav/ssl-tools/blob/master/doctor.rb. Something along these lines, where the store_context contains the failed certificat:
http.verify_callback = lambda { |verify_ok, store_context|
if !verify_ok
failed_cert = store_context.current_cert
failed_cert_reason = "%d: %s" % [ store_context.error, store_context.error_string ]
end
verify_ok
}
This is not ideal as it requires code changes in our Ruby apps, which is using httparty as a wrapper. Also we would be replicating logging that is already done by OpenSSL.
The fact that this SSL Docter script exists seems to confirm there is no Ruby OpenSSL::xxx flag to achieve this?
Would it be possible to implement such a flag? Is there an alternative way to achieve the same?
- 主要语言
- C
- 星标
- 276
- 派生
- 200
- 平均合并
- 15 小时 27 分钟
- 30 天内合并 PR
- 7
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 没有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
ruby/openssl 的其他 Issue
-
难度 2/5 1-3 小时 新手友好度 72/100
维护者通常 1 天内回复
-
难度 3/5 1-2 天 新手友好度 55/100
维护者通常 1 天内回复
-
Expose XOFs like SHAKE128 and SHAKE256可能已有人在做 @rhenium 于 88 天前认领。 未关闭
难度 4/5 3-5 天 新手友好度 48/100
维护者通常 1 天内回复
-
难度 5/5 一周以上 新手友好度 35/100
维护者通常 1 天内回复
-
Unchecked *_set_* calls可能已有人在做 @ndossche 于 158 天前认领。 未关闭
难度 4/5 3-5 天 新手友好度 35/100
维护者通常 1 天内回复
相似的 Issue
-
bug Component component: net
难度 1/5 1 小时以内 新手友好度 90/100
RT-Thread/rt-thread#11852 · 1 条评论 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 66/100
siderolabs/pkgs#1710 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 72/100